Developers Urge Fund Withdrawals After Taiko Network Compromise
Developers behind the Taiko network have issued an urgent plea for users to withdraw funds from all bridges operating on its Ethereum layer-2 blockchain, citing a confirmed compromise of its chain state verification mechanism.
In a security advisory released Sunday, the project stated that the fundamental security assumptions underpinning all bridges on Taiko could no longer be considered valid. The development team indicated they are actively collaborating with their Security Council and ecosystem partners to contain the incident, halt affected systems where feasible, and implement both technical and legal remediation strategies.
“We strongly advise all users to withdraw their funds from all bridges deployed on Taiko immediately,” the team announced on the social media platform X.
Taiko is an Ethereum layer-2 network that leverages zero-knowledge rollups to enhance transaction processing efficiency while maintaining compatibility with Ethereum. Co-founded by Daniel Wang, former CEO of Loopring, the network officially launched its mainnet in May 2024, serving as dedicated data storage for Ethereum scaling solutions.
The Taiko team has not yet disclosed the specific cause of the breach or provided an estimate of the financial losses incurred. However, blockchain security firm BlockSec Phalcon reported that the attack resulted in losses exceeding $1.7 million. In a preliminary assessment, BlockSec Phalcon suggested that the likely culprit was an exposed Raiko SGX enclave signing key that had been made publicly accessible on GitHub.
“Because the enclave signing key was publicly accessible, the SGX prover trust model may have been broken,” BlockSec Phalcon stated on X. “The exposed key may have allowed the attacker to register attacker-controlled SGX instances via SgxVerifier.registerInstance.”
According to BlockSec, attackers may have exploited compromised verifier instances to generate fraudulent proofs that were subsequently accepted by Taiko’s verification contracts. The attacker then purportedly used a forged signal to register a fake bridge message, which triggered the release of Ethereum-based assets from the protocol’s ERC20Vault.
This incident on Taiko follows a series of significant exploits within the cryptocurrency space. In April, attackers made off with $292 million from KelpDAO’s cross-chain bridge in an attack later attributed to North Korea’s Lazarus Group. In May, Echo Protocol revealed a breach involving the unauthorized minting of $77 million worth of eBTC on Monad, although the project estimated realized losses at approximately $816,000. Earlier this month, the Solana-based exchange Raydium reported a loss of $1.34 million after attackers exploited deprecated liquidity pools.
Collectively, decentralized finance (DeFi) protocols have seen losses exceeding $840 million in the first five months of the year.
Leave a Reply